SYLOGENT DEDICATED HOSTING

Transcription

1 HOSTING & PROCESS

2 SYLOGENT DEDICATED HOSTING VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM HYPERVISOR HYPERVISOR HYPERVISOR DB1 active DB2 passive Clustered hypervisors that host dedicated VMs integrated with clustered Active / Passive databases utilizing a scaleable SAN. SAN Sylogent utilizes Rackspace Critical Care Support which guarantees 1 hour hardware replacement. Sylogent performs periodic failover tests. Patch management and virus protection is coordinated with Sylogent IT and Rackspace. The work is typically completed during preset scheduled maintenance periods.

3 SYLOGENT DEDICATED HOSTING PROD TEST TRAIN VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM HYPERVISOR HYPERVISOR HYPERVISOR DB1 active DB2 passive Each client typically receives three dedicated instances of the system - Production. Testing. Training. SAN Rackspace performs nightly differential backups with weekly offsite full backups utilizing 4 week overwrite rotation.

4 Validation Plan ( optional ) Should be established and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent will provide CLIENT a 21 CFR Part 11 Compliance Assessment document along with a Validation Certificate. As an option, CLIENT is welcome to validate the system if they prefer. Role Assignment Log Should be established and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations The Role Assignment is managed within the application by either Sylogent support team and or CLIENT. Additionally, CLIENT can provide Sylogent an Excel file with CLIENT users and their assigned roles that can be input into the system by either party. The system includes a User Report that can be generated at any time to verify Role Assignments. Risk Assessment for Application System Provider needs to be aware of identified risk and mitigating measures Sylogent performs a risk assessment for each application prior to development and will provide CLIENT with its AA Risk Assessment Procedure. Specific design risks are also reviewed and addressed in validation document: This document is considered proprietary and may be viewed on-site. User Requirements Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent will provide CLIENT with document [ X ] Product Requirements. CLIENT may map their user requirements to the Functional Requirements within this document, if desired. Any additional agreed upon requirements will be processed per Sylogent s FF Change Control of Computerized Systems Procedure which Sylogent will make available to CLIENT. Data Migration Plan Must execute relevant parts of the migration plan as indicated by CLIENT Sylogent will migrate all CLIENT date from existing systems or documents as needed. Additional migration efforts need to be defined by CLIENT.

5 System Design Specifications Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent Design Specifications for all applications are considered proprietary. An on-site visit is required to view applicable design specifications. Configuration Specification Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations, provider should maintain a current system configuration specification Sylogent will provide CLIENT with System Configuration Document. Upon completion, Sylogent will configure the application with settings defined in the configuration document. Any changes to the application configuration, post launch, will be managed through the FF Change Control of Computerized Systems Procedure. Traceability Matrix Supplier should be able to demonstrate traceability of requirements and specifications to testing. Will be verified during supplier assessment. Per Sylogent s EE Software Validation Documentation procedure, Sylogent traces from Requirement to Design Specification to Test Case. Although full documents in some cases can only be viewed on-site, Sylogent will provide CLIENT with the matrix portion of each document. Technical Installation Should exist for all CLIENT installations (GxP or otherwise) Sylogent performs qualification on all application instances. Sylogent will provide CLIENT with its EE Installation Qualification Documentation Procedure. This includes the TEC Installation Protocol document that addresses technical installation. Installation Qualification Should exist for all CLIENT installations (GxP or otherwise) Sylogent performs qualification on all application instances. Sylogent will provide CLIENT with its EE Installation Qualification Documentation Procedure. The installation qualification documentation includes the TEC Installation Report which will be provided to CLIENT post-launch.

6 Software Design Specification. Software Development Plan. Software Development Testing. The supplier must follow an acceptable software development process. Sylogent follows its EE Software Development Life Cycle Procedure in conjunction with its EE Software Validation Documentation Procedure. Sylogent will provide both procedures to CLIENT. Validation documentation consists of the following documents: OQ Plan/Report o TEC Product Requirements o TEC Project Plan o TEC Design Specifications (on-site only) o TEC Technical Specifications (on-site only) o TEC Code Review Report (on-site only) o TEC Build Notes (on-site only) o TEC SQA Testing Protocol (partial) o TEC SQA Testing Report (partial) o TEC Release Notes o TEC Validation Summary Report Should exist for all CLIENT installations (GxP or otherwise) Sylogent will execute a set of test cases to verify application is configured to CLIENT Configuration Document and application is functioning as expected. Sylogent will deliver to CLIENT a report of the test case results. PQ Plan/Report Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent will execute a set of test cases to verify system is performing as expected. Sylogent will deliver to CLIENT a report of the system performance results. Change Control Process During the supplier assessment, CLIENT will verify a change control process that meets regulatory expectations is in place and followed. Sylogent will provide CLIENT with its FF Change Control of Computerized Systems Procedure.

7 Periodic Review Process During the supplier assessment CLIENT will verify a periodic review process on the system level that meets regulatory expectations is in place and followed. Sylogent will provide CLIENT with its II Product Review and Improvement Procedure. Incident Management Process During the supplier assessment CLIENT will verify an incident management process on the system level that meets regulatory expectations is in place and followed. Sylogent will provide CLIENT with its II Incident Handling Procedure. Service Level Agreement An SLA should be established between CLIENT and the supplier Sylogent will work with CLIENT to establish an appropriate SLA. SLA generally includes the following: Scope of Work and Services, Deliverables, Sylogent and Hosting Responsibilities, Customer Responsibilities, Key Contact Information, Service Requests and Notifications, Technical Support, Maintenance, Upgrades, Response Times, Standard Training Services, Exclusions, Supported Versions, Escrow. A sample of a standard SLA is attached. Training Process The supplier should have a formal training program in place and this will be verified as part of the supplier assessment. The training program should include relevant GxP topics Staff training is conducted annually and records are available on-site. Sylogent will provide CLIENT with its CC Training Procedure. Security Administration The provider must have a thorough provisioning/de-provisioning process in place and be amicable to CLIENT auditing the process routinely. Sylogent will provide CLIENT with its Sylogent s DD Master Security Procedure.

8 Retirement The supplier should have a process for system retirement as part of the life cycle approach and will be verified as part of the supplier assessment, including elimination of "CLIENT data" residing on their systems. Sylogent will provide CLIENT with its EE Application and Instance Retirement Procedure. Data Center Qualification The supplier must have a properly qualified data center; the status of the qualification must be periodically reviewed. This will be verified as part of the supplier assessment. Sylogent will provide CLIENT with its AA SYLOGENT Qualification Procedure. SYLOGENT Evaluation and SYLOGENT Assessment forms can viewed on-site, if desired. In addition, the ISO and SSAE16 Certifications (SOC reports) will be provided. Data Center Security The supplier must have data center security processes that ensure only authorized individuals have access to the data center. CLIENT will verify the existence of procedure governing these activities during the supplier assessment Sylogent will provide CLIENT with Sylogent s DD Master Security Procedure and the following documents in support of the Rackspace data center: ISO and SSAE16 Certifications (SOC Reports). Disaster Recovery CLIENT must verify a disaster recovery that meets CLIENT s requirements is in place and that it is periodically tested. This will be done as part of the supplier assessment. Sylogent will provide CLIENT with its GG Disaster Recovery and GG Business Continuity Procedures. Back Up - Recovery The supplier should have a documented process for BU&R and have evidence of successful testing. This will be verified during the supplier assessment. Sylogent will provide CLIENT with its FF Rackspace Data Hosting Procedure which addresses back up of client data. Sylogent will also provide CLIENT with its GG Administration Systems Backup and Recovery Procedure (Sylogent data only and does not house client data). Data Transfer Appropriate processes for data transfer from the provider site to a CLIENT site, or for transfer from system to system within the provider site, must be established and agreed (e.g. encryption etc.). Sylogent will provide CLIENT with its DD Data Interchange Procedure.

9 SYLOGENT 411 South State Street Newtown, PA Jack Yeager - CEO jack.yeager@sylogent.com x26 Dawn Albano - QC dawn.albano@sylogent.com x25